Privacy policy

The short version

The site collects the minimum it needs to run a diagnostic tool that has accounts, comments, and one email list on it. Everything below is detail on these eight points.

• The entire diagnostic tool works without an account and without giving any personal data at all.
• Signing in needs an email address, because the sign-in link has to arrive somewhere. No password is ever set, so none is stored.
• Your answers to diagnostic questions are recorded against a random session identifier rather than against you.
• Comments and votes are stored with your account, because they cannot work otherwise.
• Analytics are cookieless and aggregate. Nothing follows you to another site.
• The weekly email is the one list here. You are only on it if you typed your address in and then confirmed it from a link, and one click takes you off it for good.
• There is no advertising here, no advertising tracker, and no sale or sharing of personal data with anyone for their own purposes.
• To ask what is held about you, to correct it, or to have it deleted, use the contact form.

What is collected

Using the site without an account

Nothing that identifies you. You can run any diagnostic, read any fix, and leave without handing over anything.

Your answers are stored against a random session identifier generated in your browser. It is not linked to a name, an email address, or an account, and it is not designed to be traced back to a person. Those records exist for two reasons, both of which you benefit from: an answer combination that lands on a weak or missing page is a bug, and it has to be visible before it can be fixed; and the trending list has to reflect what people actually ask about rather than a guess.

Your account

Signing in uses a one-time link sent to your email address. Your email address is stored so the link can be sent and so the account can be recognised next time. No password exists, which means there is none to forget, reuse, or have stolen. Authentication is handled by Supabase, described below.

Accounts are not intended for anyone under 13, and none is knowingly kept for a child.

Practice plans and reminders

If you start a practice plan, the account stores which fix it is for, the day it started, how long it runs, and which items you tick off on which day. The drills themselves are not copied: they are read from the fix page each time, so a corrected drill is corrected in your plan too.

Reminders are off until you switch them on. If you do, the account stores the days and time you chose, your time zone (so the email arrives at your local time), and a record of when the last reminder was scheduled, so none is sent twice. Every reminder carries a one-click unsubscribe link that switches them off without signing in. A calendar file you download is generated on request and not kept.

Profile details you choose to add

Optionally, your handicap and which hand you play with. Both exist for one purpose: a left-handed golfer reading “the ball starts left” needs different wording, and a scratch golfer and a beginner are not asking the same question. Both can be left blank or cleared later. Nothing else is asked for. No real name, no date of birth, no location, no phone number.

Anything you post publicly appears with the display name on your account, so pick one you are happy to be seen with.

Comments and votes

Comments are public, and are stored with the account that wrote them so that you can edit or remove your own and so moderation is possible at all. Votes record which account voted on what, for a single reason: so that one person cannot vote twice and the count on the page is a real count. No other user is shown who voted for what.

Was this page helpful

The control at the foot of a fix records one thing: whether that page helped. It is stored against the same random session identifier as your diagnostic answers, carries no free text, and is not linked to your account. A fix that collects a run of unhelpful votes is a page that needs rewriting, which is the whole reason the control is there.

The contact form

Whatever you type into it, and an email address if you choose to include one so that a reply is possible. Messages are stored so they can be dealt with and so a follow-up makes sense. A notification is sent to an address held in a server-side setting; that address is never published on this site, which is why there is a form here and never a mail link.

The ordinary technical record

Like every web server, the hosting provider processes what arrives with a request: IP address, browser and device type, the page requested, and the time. That is used to serve the page, keep the site standing, and block abuse. It is not used to build a profile of you, and it is not joined to your account to make one.

The weekly email

There is one email list on this site, and this section describes it exactly. It is free, it is the only list, and you can read every page here without it.

You are only on it if you asked twice

Typing an address into the sign-up form does not subscribe it. It sends one email to that address with a link in it, and nothing else happens until that link is followed. That is what double opt-in means, and it is there so that somebody typing in your address costs you one email and nothing more. An address that never confirms is never sent anything again and the record of it is deleted after thirty days.

What is stored

• Your email address, because the email has to arrive somewhere.
• Two random tokens, one that confirms the address and one that unsubscribes it. They are what make both links work without you signing in. Neither can read anything or sign anyone in.
• The dates you signed up, confirmed, and unsubscribed, and the date the last email went out.
• The page you signed up from, as a path with no query string, so it is possible to tell whether the footer or the fix pages bring people in.
• Which fixes you have been sent, so that none is repeated. This is a list of page names, not a record of anything you did.
• A one-way hash of your network address at sign-up, peppered with a server secret, to keep the form from being flooded. The address itself is never written down.

Nothing else. No name, no location, no account link, and no record of whether you opened anything.

What is sent

One email a week, on a Thursday: one fault, the cause behind it in a sentence or two, and one drill, all quoted from a fix page that is already on this site for free. Then a link to that page. The only other messages the list ever sends are the confirmation link itself, and a short note if you sign up again with an address that is already on the list, so that you are not left waiting for an email that was never coming.

When you have been sent every fix on the site, the emails stop rather than starting again from the beginning.

No tracking in it

Every email is plain text. There are no images, so there is no tracking pixel, and the links are the site’s own addresses with nothing appended to them. There is no record of whether you opened an email or which links you followed, because none is collected. Reading one leaves no trace anywhere.

Never sold, never shared

Your address is used to send you this email and for nothing else. It is never sold, rented, swapped, or passed to anyone for their own purposes, it is not used to advertise anything, and it is not joined to your account, your comments, or your diagnostic history. Resend, described below, receives it in order to deliver the message and for no purpose of its own.

Leaving

Every email carries a one-click unsubscribe link, and the headers that make your mail app’s own unsubscribe button work. Either one takes effect immediately: there is nothing to confirm, no reason to give, and no further email after it. Clicking twice is harmless.

Unsubscribing keeps one row, with the date you left on it, and stops it being mailed. That record is what makes leaving hold, including against somebody else typing your address into the form afterwards. To have it removed entirely as well, ask through the contact form.

Analytics

The site uses Vercel Analytics, chosen because it is the least invasive option that still answers the only question worth asking: is this page working for the people who land on it.

• It sets no cookies and stores nothing in your browser.
• It builds no device fingerprint and assigns you no persistent identifier.
• To count visitors rather than page loads, it derives a short-lived one-way hash from the incoming request. That hash rotates, cannot be reversed into an identity, and is not stored against your account.
• It cannot follow you to another site, because there is no durable identifier to follow you with.
• What comes out is aggregate: page views, referrers, country, and broad device class. There are no heatmaps, no session recordings, and no scroll or mouse tracking. Nothing here reconstructs what one person did.

Cookies and browser storage

No advertising cookie is set on this site, by us or by anyone else. No third party sets a cookie here at all. What exists is:

• A sign-in cookie, set only when you sign in, which is what keeps you signed in. Sign out and it goes.
• Your in-progress diagnostic, kept in your browser so that a refresh or a mis-tap does not cost you the questions you have already answered. It stays on your device.
• The random session identifier described above, which ties a set of answers together without tying them to you.

There is no cookie banner because there is nothing here to consent to: the only cookie is the one that keeps you signed in, and the analytics do not use cookies at all. If that ever changes, this page changes first.

What is never done

• No advertising of any kind appears on this site.
• No advertising or marketing trackers. No pixels from ad networks or social networks, no third-party tag manager, no data brokers.
• No sale, rental, or sharing of personal data with anyone for their own purposes.
• No cross-site profiling. Nothing here is used to work out what you do elsewhere on the internet.
• No unasked-for email. Everything this site sends was switched on by you: your sign-in link, messages tied to something you did, practice reminders you set up, and the weekly email if you confirmed your address for it. Nothing is ever sent to an address that did not confirm.
• Nothing you write is used to train a machine-learning model. There is no model anywhere in this product: a diagnosis is a weighted lookup over hand-written content, which the methodology page sets out in full.

What other people can see

Public: comments you post, the display name on your account, and the total number of votes a comment has received.

Never public: your email address, your handicap, your dominant hand, your practice plans and log, your reminder settings, whether you are on the weekly email list, your diagnostic history, anything you send through the contact form, and which way you voted.

Where the data is held

Three services process data on behalf of GolfIssues and for no purpose of their own. They are named so that you can go and read what each of them does, which is worth more than a promise from an anonymous site.

• Supabase: the database and the sign-in system. It holds accounts, profiles, practice plans and reminder settings, comments, votes, contact messages, the weekly email list, and diagnostic records. Row-level security is enabled on every table, so a query can only ever reach the rows the signed-in account is permitted to see. The email list is stricter still: no query from any browser can reach it at all.
• Vercel: hosting and analytics. It serves every page and processes the ordinary technical record described above.
• Resend: email only: your sign-in link, notifications tied to something you did, practice reminders you switched on, and the weekly email if you confirmed your address for it. To send one it receives your address and the text of that message, and nothing else. Open and click tracking are off, so no email it sends for this site carries a pixel or a rewritten link.

How long it is kept

• Account and profile: until you delete the account. Deleting the account removes the account record and the profile attached to it.
• Comments: they stay published until you delete them or ask for them to be removed. If you close your account, your comments may be kept with the display name detached, because deleting one half of a conversation makes the other half unreadable. Say that you want them gone as well and they will be removed.
• Diagnostic records: kept against the session identifier, not against you, and used in aggregate to find the gaps in the content.
• The weekly email list: an address that never confirms is deleted after thirty days. A confirmed address is kept until you unsubscribe, and after that one row is kept with the date you left on it, which is what stops the address being signed up again by anyone else. Ask and that goes too.
• Contact messages: kept while the message is being dealt with and for a reasonable period afterwards, then deleted.
• Technical logs: kept briefly by the hosting provider on its own schedule, then discarded.

Access, correction, and deletion

Whatever rules apply where you live, these requests are honoured: a copy of what is held about you, a correction to anything that is wrong, deletion of your account and its data, and a request to stop a particular use of it.

Use the contact form. If you have an account, sign in first so that the request can be matched to it without an exchange of messages. There is no email address to write to, and that is the point of the form rather than an obstacle in front of it.

What to expect: a reply within a reasonable time, from a site that is small and is not staffed around the clock. When something is deleted it is deleted, not hidden behind a flag.

Security

• There is no password to steal. Signing in is a one-time link.
• Everything travels over HTTPS, and the site sends strict browser security headers on every response.
• Row-level security is enabled on every database table rather than relying on application code to remember the rules.
• Keys, and the address that contact notifications go to, live in server-side settings and never reach the browser.

No system is perfect. If you find a way to reach data you should not be able to reach, the contact form is the fastest route to someone who can fix it, and a report made in good faith will be met with thanks rather than a threat.

Changes to this policy

The date at the top of this page is the date it last changed. If something material changes, such as a new processor, a new category of data, or a new purpose for data already held, it will be described here rather than folded in quietly, and the date will move.

The terms that govern using the site are set out separately in the terms of use.